Re: [PATCH net] net: hsr: clean up the slave VLAN filters when deleting a port

[Felix Maurer <fmaurer@redhat.com>]

On Tue, Jul 14, 2026 at 04:06:36PM +0800, Jiayuan Chen wrote:
> Our internal syzkaller reported this warning:
>
>   netdevsim netdevsim10 eth0: entered promiscuous mode
>   netdevsim netdevsim10 eth1: entered promiscuous mode
>   netdevsim netdevsim10 eth1 (unregistering): left promiscuous mode
>   ------------[ cut here ]------------
>   WARNING: drivers/net/netdevsim/netdev.c:1208 at nsim_destroy+0x276/0x6e0, CPU#3: 1/46
>   Modules linked in:
>   CPU: 3 UID: 0 PID: 46 Comm: kworker/u16:1 Not tainted 7.2.0-rc2+ #286 PREEMPT
>   Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
>   Workqueue: netns cleanup_net
>   RIP: 0010:nsim_destroy (drivers/net/netdevsim/netdev.c:1031 drivers/net/netdevsim/netdev.c:1201)
>   RSP: 0018:ffffc90000337898 EFLAGS: 00010293
>   RAX: 0000000000000001 RBX: ffff8881036c8b00 RCX: 0000000000000000
>   RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
>   RBP: ffffc900003378f0 R08: 0000000000000000 R09: 0000000000000000
>   R10: ffffffffad4186a8 R11: ffffffffad41c3db R12: ffff8881036c9268
>   R13: dffffc0000000000 R14: ffffed10206d9164 R15: 0000000000000001
>   FS:  0000000000000000(0000) GS:ffff888160866000(0000) knlGS:0000000000000000
>   CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>   CR2: 000055bcf1a2e0c4 CR3: 0000000105376003 CR4: 0000000000770ef0
>   PKRU: 55555554
>   Call Trace:
>   <TASK>
>   __nsim_dev_port_del (drivers/net/netdevsim/dev.c:1547)
>   nsim_dev_reload_destroy (drivers/net/netdevsim/dev.c:1561 drivers/net/netdevsim/dev.c:1785)
>   nsim_dev_reload_down (drivers/net/netdevsim/dev.c:1038)
>   devlink_reload (net/devlink/dev.c:462)
>   devlink_pernet_pre_exit (net/devlink/core.c:578)
>   ops_undo_list (net/core/net_namespace.c:161 net/core/net_namespace.c:235)
>   cleanup_net (net/core/net_namespace.c:706)
>   process_one_work (kernel/workqueue.c:3322)
>   worker_thread (kernel/workqueue.c:3405 kernel/workqueue.c:3486)
>   kthread (kernel/kthread.c:436)
>   ret_from_fork (arch/x86/kernel/process.c:158)
>   ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
>   </TASK>
>   ---[ end trace 0000000000000000 ]---
>   netdevsim netdevsim10 eth0 (unregistering): left promiscuous mode
>
> vlan_vids_add_by_dev() is what passes the VID filter info down to the real
> device. A virtual device does no filtering itself, so it has to push the
> VIDs down to its slaves. HSR already does this correctly on the add side:
> hsr_ndo_vlan_rx_add_vid() calls vlan_vid_add() on each slave.
>
> We just never clean the slaves up on delete. hsr_del_port() drops the port
> and leaves the VIDs sitting on the slave, so the filter entries leak.
> netdevsim keeps a bitmap of the VIDs it was told to filter and checks that
> it is empty when the netdev goes away, which is what trips the warning
> above.
>
> So do the cleanup in hsr_del_port(). We follow hsr_ndo_vlan_rx_add_vid()
> here: it only pushes the VIDs to HSR_PT_SLAVE_A and HSR_PT_SLAVE_B, so the
> del side only touches those two as well.
>
> Reproducer:
> ip netns add ns0
> ip netns exec ns0 sh -c 'echo "10 2" > /sys/bus/netdevsim/new_device'
> ip netns exec ns0 ip link add hsr0 type hsr slave1 eth0 slave2 eth1
> ip netns exec ns0 ip link add link hsr0 name hsr0.1 type vlan id 1
> ip netns del ns0

Thank you for your patch! The explanation and the patch look very
similar to a fix that Eric posted a week ago [1]. Can you check if
Eric's patch also fixes you reproducer? And if it does, please add your
Tested-by and/or Reviewed-by to the thread?

Thanks,
   Felix


[1]: https://lore.kernel.org/netdev/20260707082327.3238690-1-edumazet@google.com/